PT-2018-15450

CVE-2018-20583

Published

2018-12-30

Updated

2022-05-14

Description by

CVSS 3.1

6.1

Medium

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PHP League CommonMark library versions 0.15.6 through 0.18.x

Description The issue allows remote attackers to insert unsafe URLs into HTML, even when allow unsafe links is set to false, by utilizing a newline character. This can be achieved by writing javascript as javsacri%0apt, demonstrating the potential for malicious script injection.

Recommendations For PHP League CommonMark library versions 0.15.6 through 0.18.x, update to version 0.18.1 or later to resolve the issue.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2018-20583